CVE-2021-35252

HighCVSS 7.5/10Last modified Jun 17, 2026

Description

Common encryption key appears to be used across all deployed instances of Serv-U FTP Server. Because of this an encrypted value that is exposed to an attacker can be simply recovered to plaintext.

Metrics

CVSS 3.1 7.5/10CVSS:3.1/AV:N/AC:L/PR:N/UI:N/S:U/C:H/I:N/A:N

Weakness enumeration

CWE-798 CWE-287

Affected software

Vendor	Product	Versions
SolarWinds	Serv-U FTP Server	15.3.0

References

https://cve.mitre.org/cgi-bin/cvename.cgi?name=CVE-2021-35252Third Party Advisory
https://documentation.solarwinds.com/en/success_center/servu/content/release_notes/servu_15-3-2_release_notes.htmRelease Notes, Vendor Advisory
https://www.solarwinds.com/trust-center/security-advisories/CVE-2021-35252Patch, Vendor Advisory
https://cve.mitre.org/cgi-bin/cvename.cgi?name=CVE-2021-35252Third Party Advisory
https://documentation.solarwinds.com/en/success_center/servu/content/release_notes/servu_15-3-2_release_notes.htmRelease Notes, Vendor Advisory
https://www.solarwinds.com/trust-center/security-advisories/CVE-2021-35252Patch, Vendor Advisory

Timeline

Published: Dec 16, 2022
Last modified: Jun 17, 2026
NVD status: Modified

Related CVEs from 2021

CVE-2021-352548.8SolarWinds received a report of a vulnerability related to an input that was not sanitized in WebHelpDesk. SolarWinds has removed this input CVE-2021-352619.8File Upload Vulnerability in Yupoxion BearAdmin before commit 10176153528b0a914eb4d726e200fd506b73b075 allows attacker to execute arbitrary CVE-2021-352656.1A reflected cross-site scripting (XSS) vulnerability in MaxSite CMS before V106 via product/page/* allows remote attackers to inject arbitra CVE-2021-352667.8In NTFS-3G versions < 2021.8.22, when a specially crafted NTFS inode pathname is supplied in an NTFS image a heap buffer overflow can occur CVE-2021-352677.8NTFS-3G versions < 2021.8.22, a stack buffer overflow can occur when correcting differences in the MFT and MFTMirror allowing for code execu CVE-2021-352687.8In NTFS-3G versions < 2021.8.22, when a specially crafted NTFS inode is loaded in the function ntfs_inode_real_open, a heap buffer overflow CVE-2021-352697.8NTFS-3G versions < 2021.8.22, when a specially crafted NTFS attribute from the MFT is setup in the function ntfs_attr_setup_flag, a heap buf CVE-2021-35275.5A flaw was found in the USB redirector device (usb-redir) of QEMU. Small USB packets are combined into a single, large transfer request, to CVE-2021-35288.8A flaw was found in noobaa-operator in versions before 5.7.0, where internal RPC AuthTokens between the noobaa operator and the noobaa core CVE-2021-352839.8SQL Injection vulnerability in product_admin.php in atoms183 CMS 1.0, allows attackers to execute arbitrary commands via the Name, Fname, an CVE-2021-352849.8SQL Injection vulnerability in function get_user in login_manager.php in rizalafani cms-php v1.CVE-2021-35297.1A flaw was found in noobaa-core in versions before 5.7.0. This flaw results in the name of an arbitrarily URL being copied into an HTML docu